const char *PIN = "19379148" // Authenticate PIN. 

// Return true if incorrect 
Il Compare the PIN with the correct one 
// Return true if different bool pinAuthentication() { 


bool comparePIN(char *pin) { char pin[80]; 
char tmp[80]; 
for (int i20; i<strlen(pin); i++) í bool result=false; 
if (pin[i| PINI) 
return true; 


) printf("Please, introduce PIN\r\n"); 
return false; gets(pin); 


} 


result = comparePIN(pin); 


if (result == false) { 
sprintf(tmp,"PIN correct\r\n"); 
) else { 
sprintf(tmp,"PIN %s is 
incorrect\r\n", pin); 


j 


printf(tmp); 
return result; 


const char *PIN = "19379148" // Authenticate PIN. 

// Return true if incorrect 
Il Compare the PIN with the correct one 
// Return true if different bool pinAuthentication() { 


bool comparePIN(char *pin) { char pin[80]; 
char tmp[80]; 
for (int i20; i«strlen(pin); i++) 4 bool result-false; 
if (pin[i| PINI) 
return true; 


) printf("Please, introduce PIN\r\n"); 
return false; gets(pin); 


j 


result = comparePIN(pin); 


if (result == false) { 
sprintf(tmp,"PIN correct\r\n"); 
) else í 
sprintf(tmp,"PIN %s is 
incorrect\r\n", pin); 


j 


printf(tmp); 
return result; 


const char *PIN = "19379148" // Authenticate PIN. 

// Return true if incorrect 
Il Compare the PIN with the correct one 
// Return true if different bool pinAuthentication() { 


bool comparePIN(char *pin) { char pin[80]; 
char tmp[80]; 
for (int i20; i<strlen(PIN); i++) { bool result-false; 
if (pin[i| PINI) 
return true; 


) printf("Please, introduce PINW n"); 
return false; fgets(pin,sizeof(pin),stdin); 


j 


result = comparePIN(pin); 


if (result == false) { 
sprintf(tmp,"PIN correct\r\n"); 
) else í 
sprintf(tmp,"PIN %s is 
incorrect\r\n", pin); 


j 


printf("%s",tmp); 
return result; 


const char *PIN = "19379148" // Authenticate PIN. 

// Return true if incorrect 
Il Compare the PIN with the correct one 
// Return true if different bool pinAuthentication() { 


bool comparePIN(char *pin) { char pin[80]; 
char tmp[80]; 
for (int i=0; i<strlen(PIN); i++) ( bool result=false; 
if (pin[i]!=PIN[i]) 
return true; 


) printf("Please, introduce PINW n"); 
return false; fgets(pin,sizeof(pin),stdin); 


j 


result = comparePIN(pin); 


if (result == false) { 
sprintf(tmp,"PIN correct\r\n"); 
) else í 
sprintf(tmp,"PIN %s is 
incorrect\r\n", pin); 


j 


printf("%s",tmp); 
return result; 
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const char *PIN = "19379148" // Authenticate PIN. 

// Return true if incorrect 
Il Compare the PIN with the correct one 
// Return true if different bool pinAuthentication() { 


bool comparePIN(char *pin) { char pin[80]; 
char tmp[80]; 
for (int i=0; i<strlen(PIN); i++) ( bool result=false; 
if (pin[i]!=PIN[i]) 
return true; 


} printf("Please, introduce PIN\r\n"); 
return false; fgets(pin,sizeof(pin),stdin); 


j 


result = comparePIN(pin); 


if (result == false) { 
sprintf(tmp,"PIN correct\r\n"); 
) else í 
sprintf(tmp,"PIN %s is 
incorrect\r\n", pin); 


j 


printf(" os" ,tmp); 
return result; 


result = comparePIN(pin); 
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const char *PIN = "19379148" // Authenticate PIN. 

// Return true if incorrect 
Il Compare the PIN with the correct one 
// Return true if different bool pinAuthentication() { 


bool comparePIN(char *pin) { char pin[80]; 
char tmp[80]; 
for (int i20; i<strlen(pin); i++) í bool result=false; 
if (pin[i| PINI) 
return true; 


) printf("Please, introduce PIN\r\n"); 
return false; gets(pin); 


} 


result = comparePIN(pin); 


if (result == false) { 
sprintf(tmp,"PIN correct\r\n"); 
) else { 
sprintf(tmp,"PIN %s is 
incorrect\r\n", pin); 


j 


printf(tmp); 
return result; 
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If (receivedKey != ο fff 
not authenticated(); 

else 
authenticated(); 
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void boot() { /Nerify image. Returns true is correct 
T T bool verifylmage(uint8 t “image, 
ee uint32 Џеп, uint8 t *sign, rsaKey) í 


// Load image to buffer char *hash1, *hash2; 


uint32_t len = loadFlashlmage(imgBuf) 


// Calculate Hash 


// Verify image calculateHash(image,len,hash1) 


if (verifylmage(imgBuf, len, sign, 
rsaKey) == false) ( 
goto reset;  //Auth failed 


// Verify signature 
verifySignature(sign, rsaKey, hash2) 


j 


// Compare hashes 

if (memcmp(hash1, hash2, HASH_LEN) != 0) 
return false; 

else 
return true; 


// Jump to image 
entryPoint = imgbuf; 
(*entryPoint)(); 
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void boot() { 


void (*entryPoint)(void); // Read fuses and configure security modules 


bool disableJtag = readFuse(DISABLE JTAG); 
// Load image to buffer bool enableMemoryScrambler = 
uint32_tlen = loadFlashlmage(imgBuf) readFuse(ENABLE MEM SCRAMBLER); 


bool enableTEE = readFuse(ENABLE TEE); 
11 Verify image 


if (verifylmage(imgBuf, len, sign, 

rsaKey) == false) ( if (disableJtag--true) 

goto reset;  //Auth failed closeJtag(); 
} 
if (enableMemoryScrambler==true) 
// Jump to image configureMemoryScrambler(); 
entryPoint = imgbuf; 
(*entryPoint)(); if (enableTEE--true) 
configureTEE(); 
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if (receivedKey != expected ff 
not_authenticated(); 

else 
authenticated(); 


If (receivedKey != expectedKe 
not authenticated(); 


// Do something else 


if (receivedKey != expectedKey) 
not authenticated(); 

else 
authenticated(); 


sleep(rand()); // Random delay 


if (receivedKey != expectedKey) 
not authenticated(); 

else 
authenticated(); 
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Protecting software against Fl 
https://www.riscure.com/uploads/2018/11/201708 Riscure Whitepaper Side Channel Patterns.pdf 


Fl on UDS: 
https://www.riscure.com/uploads/2018/06/ 
Riscure Whitepaper Fault injection on automotive diagnostic protocols.pdf 


Bypassing secure boot 
https://www.riscure.com/uploads/2017/10/eu-16-Timmers-Bypassing-Secure-Boot-Using-Fault- 
Injection.pdf 


Linux privileges escalation: 
https://www.riscure.com/uploads/2017/10/ 
Hiscure Whitepaper Escalating Privileges in Linux using Fault Injection.pdf 


Optical Fl 
https://www.riscure.com/uploads/201 7/09/Practical-optical-fault-injection-on-secure- 
microcontrollers.pdf 


Wild Jungle Jump attack 
https://www.riscure.com/uploads/201 7/09/Controlling-PC-on-ARM-using-Fault-Injection.pdf 


Practical DFA 
https://www.slideshare.net/secret/K8jIDL4os 1evrW 
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